Rechtstexte und B2C-Vertragsabläufe absichern

app/rate-limit.php

@@ -20,10 +20,9 @@ function app_rate_limit_check(PDO $pdo, string $bucket, int $maxAttempts, int $w
 {
     $pdo->prepare('INSERT INTO rate_limit_attempts (bucket) VALUES (?)')->execute([$bucket]);
 
-    // Opportunistic cleanup so the table doesn't grow unbounded; scoped to
-    // this bucket to keep each call cheap.
-    $pdo->prepare('DELETE FROM rate_limit_attempts WHERE bucket = ? AND created_at < DATE_SUB(NOW(), INTERVAL ? SECOND)')
-        ->execute([$bucket, $windowSeconds]);
+    // Globaler Maximalhorizont: unabhängig davon, ob derselbe Bucket je wieder
+    // benutzt wird, bleibt keine IP-basierte Rate-Limit-Zeile länger als 24h.
+    $pdo->exec('DELETE FROM rate_limit_attempts WHERE created_at < DATE_SUB(NOW(), INTERVAL 24 HOUR)');
 
     $stmt = $pdo->prepare(
         'SELECT COUNT(*) FROM rate_limit_attempts WHERE bucket = ? AND created_at >= DATE_SUB(NOW(), INTERVAL ? SECOND)'